NCC-G

We analyzed three widely used botnet datasets (CTU-13, NCC, and NCC-2) in comma-separated value (CSV) format by clustering them based on the hosts involved and the time intervals of their activities. The results of this clustering were then transformed into a graph, where hosts are represented as nodes and their communication links are defined as edges. We further examined each feature within the dataset, aggregating and analyzing the data statistically to determine the weight of the edges. The findings from the graph visualization and edge weighting were also compiled into a table format in CSV style. The "G" in NCC-G can be understood as either "Graph" or "Group Activity," reflecting the nature of the dataset, which is the result of extracting network traffic with botnet attack activities that have been grouped into activity groups and transformed into a graph.本研究针对三类广泛使用的逗号分隔值（Comma-Separated Value, CSV）格式僵尸网络数据集（CTU-13、NCC与NCC-2）展开分析，基于数据集所涉及的主机及其活动的时间间隔对数据进行聚类处理。随后将聚类结果转化为图结构，其中主机以节点形式表示，主机间的通信链路则被定义为边。本研究进一步对数据集中的各项特征逐一开展检验，通过数据聚合与统计分析确定各边的权重值。图可视化与边权重计算所得的研究结果同样被整理为CSV风格的表格格式。NCC-G中的字母“G”可理解为“图（Graph）”或“群组活动（Group Activity）”，该命名也体现了该数据集的本质：其源自对包含僵尸网络攻击活动的网络流量进行提取，将流量归类至活动群组后转化为图结构所得的最终产物。